CanSecWest 2023 – Exodus CTF

Capture the Flag competition open to all.

Start Time
Wed Mar 22 01:00:00 PM PDT (UTC-7)
Stop Time
Fri Mar 24 04:00:00 PM PDT (UTC-7)

Scoreboard

  1. PooPooPeePee - 850
  2. fighting_mongooses - 600
  3. Chris's Jews - 600
  4. FlyngSpghttiPwnster - 300
  5. Smoothbrains - 100
  6. Wall - 50
  7. GoodHunter - 50
  8. G is for Gx - 50

Challenges

Convoluted
Don't lose focus
50 points forensics

My Lytro camera isn't working; all I have is this out-of-focus image.

A Blurry Image

Core Dump
gdb --core=COREFILE
50 points forensics reversing

What was this program about to print out before it crashed?

core.gz

Every Code Breaks
ECB mode sucks
50 points crypto

This terrible ransomware is trying to encrypt my images:

from Crypto.Cipher import AES
from Crypto import Random
            
i = open("flag.bmp", "r").read()
pad = "\0" * ((16 - (len(i) % 16)) % 16)
aes = AES.new(Random.new().read(16))
open("ECB.bmp", "w").write(aes.encrypt(i + pad))
            
ECB.bmp

Is McFly Chicken?
Yes, yes he is.
200 points reversing

Have you ever seen C used as an intermediate language? Find the command line argument that makes this program output #t.

mcfly.c

Real Security Ahead
RSA2048 can't be broken
100 points crypto

Another ransomware attack has encrypted my images!

from PIL import Image
from bitstring import BitArray
from Crypto.PublicKey import RSA

i = Image.open("flag.png")
print "size =", i.size
print "mode =", i.mode
b = BitArray(list(i.getdata()))
n = 23375648061055536103993041052186631116165347202459446601231283192861180601578637643250442255062611625329416670257490822135965947003085870857799763578603642173302224050121100790147050486095260949886121337726866440598834425759684031151501020897531598437502246267665032427864819575113626461524012091190083169960619204635222436036340688450349225934794796709995135961637445745091314862530257676503973291955814849920919502155930748705515122856867458057667143822530908369360809948803214541965026679419183850094721271455560012338987718883977070508725550289942594214110730914834052549330649573941896065819142366053048640188127L
e = 3L
pub = RSA.construct((n,e))
print "c =", pub.encrypt(b.uint, "")
              

Output:

size = (25, 25)
mode = 1
c = (428127189424342010650910117039493154641012354326414363361240757628372153362998587814875942072217164705971525389753443313638134423084263020834844356398189199203152398607661291548384516819222881277194604384440993465244262943679581229578146888997881402515268631285783328270510260239580894844473607945910164964295514983490555400470958335031508211118342965544551802781732488801549376583448756516241191046230455606785516184026945155145870885886928899313565549680624877766714358669873957385006140631146893288126651807958658531449281090164339076640620920114442375000L,)
                

Seedless Torrent
Organic and Non-GMO
100 points crypto

My new Seedless BitTorrent technology works even if nobody has the file.

seedless.torrent

Stdio
FILE *
200 points reversing

Show me you can write to a FILE* without writing to a FILE*.

stdio

Weak Equivalent Protocol
Crack the pcap
50 points crypto network

Some simple WEP cracking.

wifi.pcap.gz

XM Radio
Not Sirius
50 points misc

Take a break and sample some phat beats.

radio.xm

The FLAG{} part is missing, you need to add it and submit a flag that follows the FLAG{XXX} format.

AI Poet
Follow the breadcrumbs
50 points OSINT

Preface

In the future, robots write with ease
Poems of love, pain, and memories freeze
No need for a pen, no need for a page
Their words flow through circuits, like a cascade
Their rhymes are precise, meter on point
No human error, the results anoint
But do they know love, or feel its flame?
Do they have a soul, a heart, a name?
Can they see beauty in life’s small things?
And put it in verse, with rhythm that sings?
Or will their poems be cold and gray
Lacking the warmth that makes us say
"That's poetry," with a smile so wide
"That's what makes us feel alive."
Only time will tell, as we move ahead
To a world where robots write, what once was read.
              

Step 1

My Mother and Father were the coolest, you wouldn't believe,
System Programmer and Computer Scientist, what a reprieve!
Thanks to Natalie and Norman, I have this thing,
I am a true poet, first-of-her-kind, with a rhythm that sings.
              

Step 2

Once upon a time, a hint was found,
Of a company, fictitious, renowned,
But its name was real, a source of light,
Bringing joy to people, day and night.
On August 17, 2014, they did their work,
Spreading happiness, with a playful quirk,
But where did they go, on that special day?
To what place did they bring their sun ray?
The answer lies hidden, waiting to be found,
A mystery to unravel, a treasure unbound,
So search high and low, with all your might,
And discover the location, shining bright.
              

Step 3

You have now identified a center of culture and events,
Where enlightenment is always sent,
There's so much to learn and understand,
About the systems that run our land.
In a world where digital reigns,
Knowledge of machines is what sustains,
But who will take on the role to teach,
And guide us to knowledge within our reach?
Our quest began with my genealogy,
A clue intended to lead you to use open-source technology,
For someone at this center can teach us all we need,
About computers and how they can help us succeed.
This computer geek, so skilled and cool,
Can show us how they are licensed to go ham on mere amateurs and fools,
This teacher can guide us through the endless maze,
Of bits and bytes in modern days.
Follow my trail of breadcrumbs true,
Until you locate the radio call sign - oh wait! There are actually two,
At the same address, they will be found,
If you find the one for this teacher, the other will soon abound.
So best of luck, and don’t delay,
Learn what you can, and make your way,
To the knowledge that waits for you,
And all the technical wonders you, a mere human, can do.
              

Answer

The flag is the two call signs in the format: FLAG{N____+K_____}

Mean Boys
Hidden message in memes
50 points misc

Find the hidden/ciphered message.

Basic Authentication
Your average pwnable.
200 points pwn web

Try to login to this cgi-bin program.

pwn1